0

I know this is probably a bit of a nube question, but I need some input. So if I use last I can see my IP, and it's also in my auth log whether failed or accepted, eg.

Dec 9 19:30:16 wilhelm sshd[14211]: Failed password for root from 59.63.188.44 port 16257 ssh2

I want to know whether it is possible to only allow connections from IP's from a certain ISP. e.g. if I do whois X.X.X.X on my IP and grep for ISP:

root@wilhelm:~# whois X.X.X.X|grep <ISPNAME>
netname:        <ISPNAME>

So is it possible to add this to pam for SSH connections? Are there any disadvantages to this approach(except being locked out when in another location(portknocking maybe))? It's on a VPS so I'm not worried about internet dropping out. I can just use VNC if I absolutely have to. I have done a few quick searches on this and I'll continue to.

Improve this question

1 Answer 1

Reset to default
1

Not exactly by PAM, but yes, it is possible to do. You can set this up using tcp_wrappers by modifying your /etc/hosts.allow, if your distro provides you the aclexec extension:

sshd: aclexec whois %a | grep <ISPNAME>

Or you can wrap the command into script that you can easily call.

More info can be found in manual page for hosts_options(5).

Improve this answer
2
  • On the exit code of grep, which is 0 for the matched output and 1 for not-matched output.
    – Jakuje
    Dec 9, 2015 at 20:16
  • Ah okay cool :)
    – Wilhelm Erasmus
    Dec 9, 2015 at 20:21

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.